Larry Ponemon

We are pleased to present the findings of The Cost & Consequences of Security Complexity, sponsored by MobileIron. The purpose of this research is to understand the reasons behind the growing complexity of companies’ IT security architecture and how it is affecting their ability to respond to cyber threats. We surveyed 589 individuals involved in securing, overseeing and assessing the effectiveness of their organizations’ information systems or IT infrastructure.

While some complexity in an IT security architecture is expected in order to deal with the many threats facing organizations, too much complexity, as shown in this research, can impact the ability to respond to cyber threats. Participants in this research understand the negative impact IT security complexity has on their organizations’ security posture. In order to be able to protect their organizations from cyber threats, 68 percent of respondents believe it is essential (33 percent) or very important (35 percent) to reduce complexity within their IT security architecture.

According to respondents, employees’ access to cloud-based apps and data and use of mobile devices in the workplace are the biggest drivers of complexity. The growth in unstructured data is making it increasingly difficult to deal with cyber threats.

Complexity seems unstoppable. As shown in Figure 1, complexity is a growing problem. Fifty-eight percent of respondents say in the past two years the complexity of their organizations’ IT security architecture increased significantly (28 percent) or increased (30 percent) and 66 percent believe in the next two years complexity will increase.

Following are eight consequences of complexity.

• Inability to integrate security technologies across different platforms.
• Inability to ensure policies and governance practices are applied consistently across the enterprise.
• Too many active endpoints.
• Poor investments in overly complex security technologies that are difficult to operate and financial loss due to the scrapping of these complex technologies.
• Inability to see vulnerabilities in the system.
• Difficulty in communicating the organization’s security strategy and approach to deal with cyber threats to senior management.
• Decline in productivity of IT security staff due to complexity.
• Lack of accountability for IT security practices.

Part 2. Key findings

Here is a sampling of key findings: These will be explored in more detail during a webinar held on Jan. 17. Click here to register for the webinar.

Most IT security architectures are very complex. Sixty-seven percent of respondents say their organizations’ IT security architecture is very complex.

What are the consequences of complexity? Only 35 percent of respondents rate their ability to hire and retain qualified security personnel as high (7+ on a scale from 1 = no ability to 10 = strong ability). Also problematic is the ability to integrate security technologies across different platforms (only 29 percent rate their ability as high) or to ensure policies and governance practices are applied consistently across the enterprise (only 21 percent rate their ability as high).

Employees’ use of cloud-based apps and mobile devices is considered most responsible for IT security complexity.  Some 64 percent say it is access to cloud-based applications and data and 56 percent say it is the use of mobile devices (including BYOD and mobile apps) that increase the complexity of dealing with IT security risks. The rapid growth of unstructured data and constant changes to the organization as a result of mergers and acquisitions, divestitures, reorganizations and downsizing also increase complexity.

Investments in security technologies have contributed to complexity. In the survey, 61 percent of respondents say enabling security technologies have made it more complicated to deal with threats, and 72 percent say they have lost money on poor investment in enabling security technologies.

Current security architectures are overly complex. According to 71 percent of respondents, the complexity of their companies’ IT and IT security architecture makes it difficult to see vulnerabilities in the system and 51 percent of respondents say simplified policies and processes are needed to improve the ability to respond to a changing threat landscape.

Companies shelved or scrapped enabling security technologies because of complexity. Sixty-five percent of respondents say their company has had to frequently (27 percent) or sometimes (38 percent) scrap or shelve one or more enabling security technologies because they did not effectively moderate cyber threats or were too complex to operate. The primary reason for not deploying technologies purchased is that they were too complicated to operate (63 percent of respondents. Other reasons are the lack of in-house expertise to deploy and manage the technology (54 percent of respondents) and poor vendor support and service (48 percent of respondents).

Complexity makes it difficult to explain the approach taken to reduce IT security risks to senior management. Some 67 percent of respondents believe their company’s approach to dealing with cyber threats is too complex to explain to senior executives. Such difficulty in communicating IT security practices to senior management leads to difficulty in achieving goals and objectives set by senior management (49 percent of respondents). As a result, 62 percent of respondents say their company needs to simplify and streamline its security architecture.

Complexity affects the staffing of knowledgeable IT security professionals. As discussed previously, only 35 percent of respondents rate their companies’ ability to hire and retain qualified security personnel as high; 56 percent of respondents say they do not have the necessary expertise to deal with the complexity of their IT and IT security processes and 52 percent of respondents say their companies’ current IT security infrastructure is too complicated and, as a result, decreases the productivity of their IT security staff.

Ineffective IT security architectures are costly. Respondents estimate an average potential total cost exposure from IT security failures of $77 million. The most significant financial impact results from the organization’s response to information misuse or theft followed by costs associated with reputation and brand damage because of IT security failure.

To learn more about these findings, check out the webinar

Bob Sullivan

It’s very hard to make privacy and security sexy. The folks at Mozilla and the Tactical Technology Collective have done just that this month with a clever art installation/ pop-up shop in lower Manhattan called “The Glass Room.”

The Glass Room aims to inform and challenge visitors by making them see and touch real-life representations of digital risks, the same way you might wander through an art gallery and ponder other life mysteries.

Visitors there are forced to look at an encyclopedia-style pile of books in which every password stolen from LinkedIn is printed. They are listed alphabetically, so every few minutes someone exclaims when they find their password printed in the volumes.

The point is really the sheer size of that hack…which was indeed quite a bit smaller than Yahoo’s hack announced this week.

Other works include a fitbit attached to a metronome, designed to fool the gadget’s supposed health predictive abilities; Where the F&^&* was I, a printed book showing all the places the artist had been during a year, according to the cloud; and a screen showing data on leaked by smartphones as people walk by outside.

Maya Indira Ganesh gave me a tour of the place

“It’s an art exhibition that’s trying to shine a light on what it means to live in the data society, ” she told me.  It’s also trying to scare folks a little bit.

Not all surveillance technology is bad, of course. The Glass House tells both sides of the story. Video monitors can help you check in on elderly family members, for example.  But you should always wonder: Who else is watching, and why?

Thankfully, The Glass Room includes a detox bar in the back, with Apple-store-like “ingeniuouses” there to help you fix the privacy settings on your gadgets.  They also offer an 8-day data detox kit, which I’ll be sharing in the future.

The Glass Room first popped-up in Germany before making its way to Manhattan this month.  The store closes this weekend, but you can browse the entire exhibit online.  And, better yet, you can watch the videos I’ve attached to this story.

Larry Ponemon

A serious and life-threatening problem in healthcare organizations is a medical error or adverse event due to the misidentification of patients. In the 2016 National Patient Misidentification Report of nurses, physicians, and IT practitioners, we examine the frequency and root causes of near misses, adverse event and sentinel events due to patient misidentification. We also survey CFOs and others in financial operations to determine the financial consequences of denied claims due to patient misidentification. A total of 460 individuals participated in this research.

How serious is the problem? Eighty-six percent of respondents say they have witnessed or know of a medical error that was the result of patient misidentification. The two primary root causes of patient misidentification are mistakes made when a patient is registered (63 percent of respondents) and the pressure to treat patients quickly (60 percent of respondents).

Difficulty in finding charts or medical records and finding duplicate medical records for a patient contributes to errors — 68 percent of respondents say when caring for a patient they have a hard time finding their chart or medical record almost all the time and 67 percent of respondents say when searching for information about the patient they find duplicate medical records for that patient almost all the time.

In addition to life and death consequences from making mistakes, healthcare organizations are losing money because of denied claims connected with patient misidentification. An analysis of costs associated with the denial of claims due to patient misidentification is provided in Appendix 1 of this report.  It shows that the average-sized hospital incurs reworking costs exceeding $71,000 per year. We also estimate the total cost of $1.2 million for rejected claims that resulted from patient misidentification.

Key takeaways from this study include the following.

Most patient misidentification starts at registration. Eighty-four percent of respondents strongly agree or agree that misidentifying a patient can lead to medical errors or adverse events. These include a near miss, sentinel event and even death.

Misidentification starts at the beginning of the patient’s experience.  Most misidentification occurs when the patient is being registered for a procedure (63 percent of respondents). Another primary cause for errors is the time pressure nurses, physicians and physicians assistants experience when treating patients (60 percent of respondents).

What leads to patient misidentification? According to 64 percent of respondents, a patient is misidentified in the “typical” healthcare facility very frequently or all the time. The following errors are very common in most healthcare facilities.

• Inability to find a patient’s chart or medical record (68 percent of respondents)
• A search or query that results in multiple or duplicate medical records for that patient (67 percent of respondents)
• A wrong record is associated with the wrong patient because of the same name and/or date of birth (56 percent of respondents)
• The wrong record is pulled up for a patient because another record in the registration system or EMR has the same name and/or date of birth (61 percent of respondents)

Correcting or getting additional patient information contributes to medical errors. Also putting patients at risk is the inability to quickly get information that is missing or incomplete in patient records. According to 37 percent of respondents, up to or more than one hour is spent contacting medical records or HIM department to get critical information about their patients.

What are the medical consequences of patient misidentification? Patient misidentification can result in errors in medication, blood transfusion and radiation that could have life and death consequences for patients. Ninety percent of respondents say medication errors could be fatal.

Research points to the need to improve the accuracy of patient registration. As part of this research, we surveyed CFOs and individuals involved in the healthcare facility’s revenue cycles. As with clinicians, the most common root cause is incorrect patient identification at registration such as an incorrect armband placement followed by reliance on homegrown or obsolete identification systems.

Denied claims from providing wrong patient information cost healthcare organizations. The patient identification process at registration can be cumbersome and challenging and can result in unintended duplicate medical records and overlays due to typing errors or miscommunication. Such errors can result in denied claims.

Sixty-five percent of respondents involved in the finances of healthcare organizations believe denied claims have a very significant or significant impact on accounts receivable. On average, hospitals have 30 percent of all claims denied and an average of 35 percent of these denied claims are attributed to inaccurate patient identification or inaccurate/incomplete patient information.

The use of biometrics can ensure proper patient identification. Seventy-two percent of respondents believe positively identifying a patient at registration through biometrics could improve cash flow for their hospitals. Positively identifying a patient at registration through biometrics could reduce denied claims (76 percent of respondents) by an average of 25 percent. It could also reduce the average number of days in accounts receivable (104 days) by an average of 22 percent. As a result of reducing denied claims, 80 percent of respondents say their hospital’s cash flow could improve by an average of 25 percent.

Healthcare executives and care providers believe the use of biometrics could reduce the consequences of patient misidentification. A positive (biometric) patient identification could reduce overall medical errors and adverse events, according to 77 percent of respondents. In fact, 50 percent of all deaths could be eliminated with such technology, according to respondents.

Click here to download the full report.

Bob Sullivan

There’s fresh evidence out Wednesday to show the ransomware epidemic has staying power. Why? Victims are paying ransoms for their data, that’s why.

Madison County, Indiana made headlines last week because it admitted a recent ransomware attack will cost taxpayers there $220,000 — some to the hackers, most for security upgrades.

But Madison County shouldn’t be singled out. Ransomware nightmares  — involving malicious software that encrypts victims’ data and won’t “give it back” unless a fee is paid —  are playing out everywhere.  The Carroll County, Arkansas, sheriff’s department admitted this week it had paid $2,400 to recover data held captive from the its law enforcement management system, which holds reports, bookings and other day-to-day operational data, according to Townhall.com.

The hits keep coming because victims keep paying; and victims keep paying because they seem to have no other choice.  Obviously, criminals keep will keep doing what works.

IBM researchers set out recently to understand the prevalence of ransomware. In a report released Wednesday, IBM’s X-Force said that the volume of spam containing ransomware has skyrocketed.  The FBI claims there were an average of 4,000 attacks per day in the first quarter of 2016.

And yet, IBM found that only 31 percent of consumers had even heard the term “ransomware.” Meanwhile, 75 percent said they “are confident they can protect personal data on a computer they own.”  Meanwhile, 6 out of 10 said they had not taken any action in the past three months to protect themselves from being hacked.

That’s head-in-the-sand stuff, folks. Forward your friends this story now — but don’t include it as an attachment, please.

Meanwhile, companies seem to be more realistic, and more frightened — 56 percent of companies surveyed by the Ponemon Institute said, in a separate study, they are not ready to deal with ransomware. (I have a business partnership with Larry Ponemon at PonemonSullivanReport.com).

All this matters because a majority of consumers and corporations actually say they’d pay to recover data encrypted by a criminal. Some 54 percent said they’d pay up to $100 to get back financial data, and 55 percent said they’d do so to retrieve lost digital photos. Not surprisingly, Parents (71 percent) are much more concerned than non-parents (54 percent) about family digital photos being held for ransom or access blocked.

(Back up those family photos, kids!)

Now, for the meat of the report.  Many corporations told IBM that they had already paid ransom for data — seven in ten of those who have experience with ransomware attacks have done so, with with more than half paying over $10,000, IBM said.  Many paid more.

• 20 percent paid more than $40,000
• 25 percent paid $20,000 – $40,000
• 11 percent paid $10,000 – $20,000

“The perception of the value of data, and the corresponding willingness to pay to retrieve it, increases with company size. Sixty percent of all respondents say their businesses would pay some ransom and they’re most willing to pay for financial (62 percent) and customer/sales records,” the report said.

All this paying up flies in the face of law enforcement’s advice, which is to never pay.

“Paying a ransom doesn’t guarantee an organization that it will get its data back,” said FBI Cyber Division Assistant Director James Trainor in a report earlier this year. “We’ve seen cases where organizations never got a decryption key after having paid the ransom. Paying a ransom not only emboldens current cybercriminals to target more organizations; it also offers an incentive for other criminals to get involved in this type of illegal activity. And finally, by paying a ransom, an organization might inadvertently be funding.”

Of course, the FBI is looking at the macro impact, while the victims are looking at a huge, immediate micro problem.

How can you protect yourself?  IBM says the main way ransomware arrives is through an unsolicited email with a booby-trapped attachment — usually a Microsoft Office document that asks for macro permissions. So don’t click on those and you’ve gone a long way towards protecting yourself. Here’s some other tips from IBM.

Banish unsolicited email: Sending a poisoned attachment is one of the most popular infection methods used by ransomware operators. Be very discerning when it comes to what attachments you open and what links you click in emails.

No macros: Office document macros have been a top choice for ransomware operators in 2016. Opening a document and that then requires enabling macros to see its content is a very common sign of malware, and macros from email should be disabled altogether.

Update and patch: Always update your operating system, and ideally have automatic updates enabled. Opt to update any software you use often, and delete applications you rarely access.

Protect: Have up-to-date antivirus and malware detection software on your endpoint. Allow scans to run completely, and update the software as needed. Enable the security offered by default through your operating system, like firewall or spyware detection.

Junk it: Instead of unsubscribing from spam emails, which will confirm to your spammer that your address is alive, mark it as junk and set up automatic emptying of the junk folder.

Bob Sullivan

There’s fresh evidence out Wednesday to show the ransomware epidemic has staying power. Why? Victims are paying ransoms for their data, that’s why.

Madison County, Indiana made headlines last week because it admitted a recent ransomware attack will cost taxpayers there $220,000 — some to the hackers, most for security upgrades.

But Madison County shouldn’t be singled out. Ransomware nightmares  — involving malicious software that encrypts victims’ data and won’t “give it back” unless a fee is paid —  are playing out everywhere.  The Carroll County, Arkansas, sheriff’s department admitted this week it had paid $2,400 to recover data held captive from the its law enforcement management system, which holds reports, bookings and other day-to-day operational data, according to Townhall.com.

The hits keep coming because victims keep paying; and victims keep paying because they seem to have no other choice.  Obviously, criminals keep will keep doing what works.

IBM researchers set out recently to understand the prevalence of ransomware. In a report released Wednesday, IBM’s X-Force said that the volume of spam containing ransomware has skyrocketed.  The FBI claims there were an average of 4,000 attacks per day in the first quarter of 2016.

And yet, IBM found that only 31 percent of consumers had even heard the term “ransomware.” Meanwhile, 75 percent said they “are confident they can protect personal data on a computer they own.”  Meanwhile, 6 out of 10 said they had not taken any action in the past three months to protect themselves from being hacked.

That’s head-in-the-sand stuff, folks. Forward your friends this story now — but don’t include it as an attachment, please.

Meanwhile, companies seem to be more realistic, and more frightened — 56 percent of companies surveyed by the Ponemon Institute said, in a separate study, they are not ready to deal with ransomware. (I have a business partnership with Larry Ponemon at PonemonSullivanReport.com).

All this matters because a majority of consumers and corporations actually say they’d pay to recover data encrypted by a criminal. Some 54 percent said they’d pay up to $100 to get back financial data, and 55 percent said they’d do so to retrieve lost digital photos. Not surprisingly, Parents (71 percent) are much more concerned than non-parents (54 percent) about family digital photos being held for ransom or access blocked.

(Back up those family photos, kids!)

Now, for the meat of the report.  Many corporations told IBM that they had already paid ransom for data — seven in ten of those who have experience with ransomware attacks have done so, with with more than half paying over $10,000, IBM said.  Many paid more.

• 20 percent paid more than $40,000
• 25 percent paid $20,000 – $40,000
• 11 percent paid $10,000 – $20,000

“The perception of the value of data, and the corresponding willingness to pay to retrieve it, increases with company size. Sixty percent of all respondents say their businesses would pay some ransom and they’re most willing to pay for financial (62 percent) and customer/sales records,” the report said.

All this paying up flies in the face of law enforcement’s advice, which is to never pay.

“Paying a ransom doesn’t guarantee an organization that it will get its data back,” said FBI Cyber Division Assistant Director James Trainor in a report earlier this year. “We’ve seen cases where organizations never got a decryption key after having paid the ransom. Paying a ransom not only emboldens current cybercriminals to target more organizations; it also offers an incentive for other criminals to get involved in this type of illegal activity. And finally, by paying a ransom, an organization might inadvertently be funding.”

Of course, the FBI is looking at the macro impact, while the victims are looking at a huge, immediate micro problem.

How can you protect yourself?  IBM says the main way ransomware arrives is through an unsolicited email with a booby-trapped attachment — usually a Microsoft Office document that asks for macro permissions. So don’t click on those and you’ve gone a long way towards protecting yourself. Here’s some other tips from IBM.

Banish unsolicited email: Sending a poisoned attachment is one of the most popular infection methods used by ransomware operators. Be very discerning when it comes to what attachments you open and what links you click in emails.

No macros: Office document macros have been a top choice for ransomware operators in 2016. Opening a document and that then requires enabling macros to see its content is a very common sign of malware, and macros from email should be disabled altogether.

Update and patch: Always update your operating system, and ideally have automatic updates enabled. Opt to update any software you use often, and delete applications you rarely access.

Protect: Have up-to-date antivirus and malware detection software on your endpoint. Allow scans to run completely, and update the software as needed. Enable the security offered by default through your operating system, like firewall or spyware detection.

Junk it: Instead of unsubscribing from spam emails, which will confirm to your spammer that your address is alive, mark it as junk and set up automatic emptying of the junk folder.

Larry Ponemon

Ponemon Institute is pleased to present the findings of the 2016 Cost of Insider Threats study sponsored by Dtex. The purpose of this benchmark study is to understand the direct and indirect costs that result from insider threats. In the context of this research, insider threats are defined as:

• A careless or negligent employee or contractor,
• A criminal or malicious insider or
• A credential thief.

We interviewed 280 IT and IT security practitioners in 54 organizations from April to July 2016. Each organization experienced one or more material events caused by an insider. These organizations experienced a total of 874 insider incidents over the past 12 months. Our targeted organizations were business organizations with a global headcount of 1,000 or more employees located throughout the United States.

Imposter risk is the most costly

The cost ranges significantly based on the type of incident. If it involves a negligent employee or contractor, the incident can average $206,933. The average cost more than doubles if the incident involves an imposter or thief who steals credentials ($493,093). Criminal and malicious insiders cost the organizations represented in this research an average of $347,130.  The activities that drive costs are: monitoring & surveillance, investigation, escalation, incident response, containment, ex-post analysis and remediation.

The negligent insider is the root cause of most incidents

Most incidents in this research were caused by insider negligence. Specifically, the careless employee or contractor was the root cause of almost 600 (598) of the 874 incidents reported. The most expensive incidents, due to imposters stealing credentials, were the least reported and totaled 85 incidents.

Organizational size and industry affects the cost per incident

The cost of incidents varies according to organizational size. Large organizations with a headcount of more than 75,000 spent an average of $7.8 million to resolve the incident. To deal with the consequences of an insider incident, organizations with a headcount between 1,000 and 5,000 spent an average of $2 million. Financial services, retail, industrial and manufacturing spent an average of $5 million.

User behavior analytics combined with other tools reduce the total cost

Using incremental analysis, we recalculated the total cost of insider-related incidents under the condition that a given tool or activity is deployed across the enterprise. Companies that deploy user behavior analytics (UBA) realized an average cost reduction of $1.1 million. The use of threat intelligence systems resulted in an $0.8 million average cost reduction.  Similarly, the deployment of data loss prevention (DLP) tools resulted in an average cost reduction of $0.7 million. Companies that deploy user behavior analytics in combination with threat intelligence, employee monitoring and data loss prevention have an average total cost of $2.8 million, which is $1.5 million lower than the overall average.

 Click here to read the rest of the study

Wikileaks. The alleged email that led to compromise of John Podesta’s account.

Bob Sullivan

A simple, decade-old hacker trick likely led to the hacking of critical Hillary Clinton staff members. If John Podesta can fall for it, with the Presidential election at stake, so can you. So listen up.

I know I sound like a broken record when I warn people to think before they click, and I know most people think they’ll never fall for silly hacker tricks, but hey, this stuff is important.  It very well might have an impact on who gets to be the leader of the free world.

Information continues to trickle out of hacked emails that come from senior officials in Hillary Clinton’s campaign team, including campaign chair John Podesta. This month brought additional evidence describing how it happened.

It was pretty easy.

It appears that Podesta, and hundreds of other Clinton camp workers, received targeted phishing emails telling them they had to change their password immediately.  Of course, workers who fell for the email were led to a look-alike page controlled by hackers.  Part of the reason the dupe worked involved links that used of URL-shortening service Bitly, which turns long web addresses into short ones for convenience. Bitly also has the terrible quality of completely obscuring where the clicker is actually going until it’s too late.  For years, I’ve thought this to be a security flaw inherent in link shorterners, and I believe Bitly and other URL shorteners needed to engineer a fix.

In the meantime, you need to know three critical things:

A) Bitly links can’t be trusted; never click on a Bitly link when anything even remotely sensitive is involved

B) Any plea to urgently change your password should be met with serious skepticism. When you decide to do so, always manually type the service’s address into your web browsers and navigate to its password update page. NEVER click on a link telling you to do so. Even if you are sure it’s legitimate.

C) The presidential election might hang in the balance because of this simple hack. So, yes, anyone can fall for it. You can too.

The Bitly link

Back in June, SecureWorks published a pretty convincing research paper that reconstructed the careful attack on the Hillary Clinton Presidential Campaign.  Analyzing data left publicly available on a Bitly account, it found evidence of thousands of spear phishing emails targeting election officials between March and June of this year.    The targets included: national political director, finance director, Director of strategic communications, and so on.

For example, 213 links were created targeting 108 email addresses at HillaryClinton.com. The hackers succeeded again and again: “20 of the 213 short links have been clicked as of this publication. Eleven of the links were clicked once, four were clicked twice, two were clicked three times, and two were clicked four times,” the report says.

The group also targeted personal Gmail accounts belonging to campaign officials.  This produced plenty of hits, too.

“They include the director of speechwriting for Hillary for America and the deputy director office of the chair at the DNC,” the report says. “(The hackers) created 150 short links targeting this group. As of this publication, 40 of the links have been clicked at least once.”

Clicking on a link does not mean the clicker subsequently entered login information and fell for the scam.  But the high click rate certainly suggests some victims did. So does the timing of all this; The DNC hack was revealed in June, weeks after this spear phishing campaign.

Release last week of what appears to be the actual email that led to the hacking of Podesta’s email on Wikileaks — sorry for the circular reasoning there — seems to confirm SecureWorks’ analysis.  An email sent to John.Podesta@gmail.com appears to come from Google and wants that someone located in the Ukraine had tried to access his account.

“Google stopped this sign-in attempt. You should change your password immediately,” it says. “CHANGE PASSWORD.”  And there’s a link headed for bit.ly/1PibSU0.

Click on that Bitly link, and you are today brought to a warning page saying there “might be a problem with the requested link.”  A bit too late for Podesta and the Clinton campaign.

The ultimate destination for that link appears to be Google, but it’s not. Instead, it sends visitors to a web site at http://myaccount.google.com-securitysettingpage.tk

An IT worker for the Clinton campaign ominously comments in the thread posted at Wikileaks that “this is a legitimate email,” though to his credit, he leaves instructions to visit Google at the correct link to change the password.

Then, ironically, he offers this call to action:

“Does JDP (John Podesta) have the 2 step verification or do we need to do with him on the phone? Don’t want to lock him out of his in box!”

If only a locked inbox were the biggest email problem Podesta had.

Larry Ponemon

Ponemon Institute is pleased to present the findings of Global Trends in Identity Governance & Access Management, sponsored by Micro Focus. The purpose of this study is to understand companies’ ability to protect access to sensitive and confidential information and what they believe is necessary to improve the protection.

All participants in this study are involved in providing end users access to information resources in their organizations.
In this study, we surveyed 2,580 IT and IT security practitioners in North America, United
Kingdom, Germany, EMEA, Brazil, LATAM and Asia-Pacific1. The consolidated findings are
presented in this report. The findings for North America, UK, Germany and Brazil are published in separate reports.

On average, companies represented in this research must provide identity
governance and access support to approximately 13,000 internal users (employees) and 191,000 external users (contractors, vendors, business partners, customers and consumers).

All enterprise organizations are under pressure to drive business innovation in order to respond to changes in the competitive landscape, and to meet changing customer expectations. This is fueling a trend toward digitalization as more resources and interaction move online, requiring greater and freer access to online information sources. Yet the survey shows that the security, access management, and governance processes to support this digitalization are not yet in place.

In this study, we have identified the following trends that will have a significant impact on how
organizations will be managing identity governance and access.

1. Employees are frustrated with access rights processes, and IT security is considered a
bottleneck. Sixty-two percent of respondents say IT security is viewed as a bottleneck in the
process for assigning and managing access rights to users and 57 percent of respondents
say employees are frustrated with the current process for assigning and managing access
rights.

2. Responding to requests for access is considered slow.
Only 41 percent of respondents say the function that provides end-user access to information resources is quick to respond to such changes as termination or role changes. These findings may explain why lines of business and application owners are taking charge of access when
it comes to the cloud.

3. Control over access management is decentralized.
According to 59 percent of respondents, senior leaders prefer each business function to determine what access privileges are required for a given user’s role and function.
In the cloud environment, responsibility is more decentralized. Twenty-nine percent of
respondents say lines of business and 21 percent say it is the application owner who is
deciding end-user access in the cloud environment.

4. Certain technologies are considered an important part of meeting identity governance
and access management requirements. These are multi-factor authentication (69 percent
of respondents), identity and access management (69 percent of respondents), access
request systems (67 percent of respondents) and biometric authentication (60 percent of
respondents.

5. A single-factor authentication approach is no longer effective. Seventy-five percent of
respondents say a single-factor authentication approach, including username and password,
can no longer effectively prevent unauthorized access to information resources.

6. Integration of machine learning within identity governance solutions is critical (64
percent of respondents). Also considered critical are scalability to achieving an effective
identity governance process and compliance with leading standards or guidelines, both noted
by 63 percent of respondents.

Click here to download and read the full report.

Bob Sullivan

With U.S. officials openly blaming Russia for hacker attacks on state election computer systems, and the myriad possibilities for election chaos such attacks raise, it’s important to put them in proper context. I went to Harri Hursti, a globally-known election security consultant, for some answers.  Hursti cut his teeth in the Finnish military fending off electronic attacks, so he has valuable perspective – particularly on a unique part of Russian culture which could explain who is really behind the attacks.  He also explains the potential for psychological warfare in this incident, and why it all feels a bit familiar to his Cold War sensibilities.

Harri Hursti developed the Hursti Hack(s), in which he demonstrated how the voting results produced by the Diebold Election Systems voting machines could be altered. HBO turned the Hursti Hack into a documentary called “Hacking Democracy” which was nominated for an Emmy award for outstanding investigative journalism. Hursti is co-author of several studies on data and election security, and his consultancy. Nordic Innovation Labs, advises governments around the world on election vulnerabilities.

Between 1984-1989, Hursti worked for the UNESCO and the Finnish military in technology and cyber defense initiatives.

What do you think of the news that a member of Congress says there is “no doubt” that Russia is behind recent attacks on state election systems: (http://www.reuters.com/article/us-usa-election-cyber-idUSKCN1220SL)?

The article makes several dangerous assumptions about the security of elections and election systems. Representative Adam Schiff said he doubted (Russians) could falsify a vote tally in a way that effects the election outcome. He also said outdated election systems makes this unlikely, but really, it just makes it easier. The voting machines were designed at a time when security wasn’t considered, included, or part of the specifications at all.

These outdated computers are extremely slow. They don’t have the extra horsepower to do decent security on top of the job they were designed for. Basically, the voting machine is as powerful as today’s refrigerator or toaster, but some use the same components and logistics so outdated doesn’t mean it’s forgotten and obsolete, it means that it’s common and therefore a lot of people still today know how those systems work and can subvert them. “Outdated” isn’t offering any protection from an attacker, quite the opposite.

So there’s no proof of voter registration tampering?

As in voting machines, the registration machine don’t have the capability of logging an alteration, and they are trivially altered themselves. It’s meaningless to claim there’s no evidence, since the systems don’t have the capability to report when they’re altered. These are not standard parts of a database so there’s no common sense in saying “there’s some sort of feature that would do that, right?” Unless we study the system we can’t know one way or the other. This isn’t a common sense claim, this is a claim that would require a forensic investigation.

In addition, the number of vendors and different systems is low, so a skillful attacker doesn’t need to learn hundreds of systems; they only need to know a half dozen to control all of the U.S. election systems. But a skillful attacker only needs to learn one system in order to manipulate enough votes to tilt the election, even if it’s not close to tied. This means the attacker has more places to go to be strategic and instead of going to a big jurisdiction, They’ll go to 10 smaller ones with fewer resources and less (attention). But if you calculate the gap you need to fill to alter an election you go to the smaller, underfunded and less technologically savvy districts to own the state.

Also, some states too have made state-wide decisions that one system is used across the state, or jursdictions are central count only. So a statement that the US is decentralized is a false statement. It’s easy to understand why people think that, but from an attacker’s point of view, the threat model, you could not ask for an easier target. And the diversity between small jurisdictions is limited. An attacker can choose the jurisdictions based on the systems they are best skilled to attack.

How can the US be so sure it’s Russia?

It can’t. It is very hard to find from where a network attack is coming from. It is equally easy to make certain that investigators will find “the trail” which is pointing to the wrong direction. Therefore under the assumption that you’re dealing with a skillful attacker, any trail found is a red flag for the fact there are so many ways to make it virtually impossible to find the trail. Any conclusive looking trail “found” should be considered suspect. Unless it’s a false trail, you can only say we suspect them, and until you get to the real people to the level of the actual perpetrators true identities, you can’t make a conclusion as to “where” they come from.

Could it have been Russia?

We could use a working hypothesis, or a reasonable suspicion of Russian involvement, but until you’re down to individual people you don’t know who they are. They might even have been based in Russia, but have arrived there as tourists to carry out their attacks. There’s no way to know who the individual attackers are until they’re confronted.

Given your Cold War background, does this feel familiar?

The Cold War was all about ideology, and therefore a large concept was something that we today call hybrid warfare. In that game the actual technological attacks are equally important as the psychological influencing of the general population with misinformation and misdirection. So this is all very familiar.

Also, something we in the Western world don’t understand is how deeply patriotic Russians are. Individual Russians, and self-organized groups, are willing to go to great lengths on their own, with their own initiative, if they believe that what they do will benefit Mother Russia, and/or in hope and believe that their actions once known will be rewarded. So this kind of self-initiated actions which do resemble organized operations are commonplace. Bearing in mind that the self-organized groups can have members whose day jobs are close to the government the remaining question is, is the government aware of these groups, and if they are, are they encouraging or discouraging? Which is something we cannot know. But the fact of the matter is that Russia is self-organizing and self-providing the capability of plausible deniability which in many case can be actually true that they didn’t know.

Also, it is good to understand how high is the level of science education in Russia and the eastern bloc, when East Germany and West Germany united they had to tone down the science education in East Germany in order to match the West Germans. Science education in East Germany was way higher. The percentage of people in the general population of Russia who possess the relevant skill sets for carrying out this kind of attack is higher than we assume based on western standards. And that’s not just Russia but the whole Eastern Bloc, it was very high and is still.

Given the number of, say, smartphones and laptops used today how hard is it to fend off an attack?

In today’s world where we have “bring you device” models everywhere, we inherently assume every risk the wireless world brings to us. Our laptops and mobile phones are paired to our home networks and other wireless places we visit. It is still not understood how little security WiFi has and how easy it is with an “evil” access point to gain a connection to a target, and once you have a target you can start to work to gain access.

To mitigate this we have two possible paths. One path is to ultra-high security with all the restrictions it comes with. The alternative is to assume a breach is imminent and utilize experts to put in place an active defense mechanism which catches the breach before the attacker can use the breach to gain access to valuable information.

What would an appropriate US response be if the U.S. discovered foreign hackers in its election system?

The first action is obviously to secure your home base. Taking into account the difficulty of identifying the actual attacker, a public retaliation towards an assumed attacker may be part of the attacker’s plan and intensify the attack. Hence, public retaliation is not an effective defense. Public disclosure is important, but after the fact and after the situation has been properly handled.

Finally what is the real risk here? Could Russian hacking throw the Nov. 8 result into doubt? Could Trump supporters, should they lose, blame Russia, for example?

There’s a myriad of risks. Just to start from the simple fact that attacking the voter registration system is a highway to all crimes involving identity theft. Therefore, massive breaches of voter registration databases might lead to discouragement of people to participate in the democratic process and cause them to drop out by ceasing to be registered voters. It also poses a national security level threats, by allowing malicious actors and adversaries to gain valuable intel whether it is personal-level attacks or whether it is for hybrid warfare psyops.

It is also important to understand that data theft takes the public interest. but detect injection or insertion is far more serious. In this attack, the U.S. could be a set up for later attacks and set up false identities to be leveraged for multiple purposes in and out of the election space.

For example, a voter registration database interacts with a lot of government databases, such as criminal records. While common sense might say this kind of interaction should be a one way street, in reality the implementations quite often allow two-way interaction between the data sources. Therefore from one jurisdiction to another it should be carefully analyzed what kind of data propagation inserted voted records could lead to. Remember only US citizens can be voters, so a registered voter is assumed to be a citizen already.

Bob Sullivan

With U.S. officials openly blaming Russia for hacker attacks on state election computer systems, and the myriad possibilities for election chaos such attacks raise, it’s important to put them in proper context. I went to Harri Hursti, a globally-known election security consultant, for some answers.  Hursti cut his teeth in the Finnish military fending off electronic attacks, so he has valuable perspective – particularly on a unique part of Russian culture which could explain who is really behind the attacks.  He also explains the potential for psychological warfare in this incident, and why it all feels a bit familiar to his Cold War sensibilities.

Harri Hursti developed the Hursti Hack(s), in which he demonstrated how the voting results produced by the Diebold Election Systems voting machines could be altered. HBO turned the Hursti Hack into a documentary called “Hacking Democracy” which was nominated for an Emmy award for outstanding investigative journalism. Hursti is co-author of several studies on data and election security, and his consultancy. Nordic Innovation Labs, advises governments around the world on election vulnerabilities.

Between 1984-1989, Hursti worked for the UNESCO and the Finnish military in technology and cyber defense initiatives.

What do you think of the news that a member of Congress says there is “no doubt” that Russia is behind recent attacks on state election systems: (http://www.reuters.com/article/us-usa-election-cyber-idUSKCN1220SL)?

The article makes several dangerous assumptions about the security of elections and election systems. Representative Adam Schiff said he doubted (Russians) could falsify a vote tally in a way that effects the election outcome. He also said outdated election systems makes this unlikely, but really, it just makes it easier. The voting machines were designed at a time when security wasn’t considered, included, or part of the specifications at all.

These outdated computers are extremely slow. They don’t have the extra horsepower to do decent security on top of the job they were designed for. Basically, the voting machine is as powerful as today’s refrigerator or toaster, but some use the same components and logistics so outdated doesn’t mean it’s forgotten and obsolete, it means that it’s common and therefore a lot of people still today know how those systems work and can subvert them. “Outdated” isn’t offering any protection from an attacker, quite the opposite.

So there’s no proof of voter registration tampering?

As in voting machines, the registration machine don’t have the capability of logging an alteration, and they are trivially altered themselves. It’s meaningless to claim there’s no evidence, since the systems don’t have the capability to report when they’re altered. These are not standard parts of a database so there’s no common sense in saying “there’s some sort of feature that would do that, right?” Unless we study the system we can’t know one way or the other. This isn’t a common sense claim, this is a claim that would require a forensic investigation.

In addition, the number of vendors and different systems is low, so a skillful attacker doesn’t need to learn hundreds of systems; they only need to know a half dozen to control all of the U.S. election systems. But a skillful attacker only needs to learn one system in order to manipulate enough votes to tilt the election, even if it’s not close to tied. This means the attacker has more places to go to be strategic and instead of going to a big jurisdiction, They’ll go to 10 smaller ones with fewer resources and less (attention). But if you calculate the gap you need to fill to alter an election you go to the smaller, underfunded and less technologically savvy districts to own the state.

Also, some states too have made state-wide decisions that one system is used across the state, or jursdictions are central count only. So a statement that the US is decentralized is a false statement. It’s easy to understand why people think that, but from an attacker’s point of view, the threat model, you could not ask for an easier target. And the diversity between small jurisdictions is limited. An attacker can choose the jurisdictions based on the systems they are best skilled to attack.

How can the US be so sure it’s Russia?

It can’t. It is very hard to find from where a network attack is coming from. It is equally easy to make certain that investigators will find “the trail” which is pointing to the wrong direction. Therefore under the assumption that you’re dealing with a skillful attacker, any trail found is a red flag for the fact there are so many ways to make it virtually impossible to find the trail. Any conclusive looking trail “found” should be considered suspect. Unless it’s a false trail, you can only say we suspect them, and until you get to the real people to the level of the actual perpetrators true identities, you can’t make a conclusion as to “where” they come from.

Could it have been Russia?

We could use a working hypothesis, or a reasonable suspicion of Russian involvement, but until you’re down to individual people you don’t know who they are. They might even have been based in Russia, but have arrived there as tourists to carry out their attacks. There’s no way to know who the individual attackers are until they’re confronted.

Given your Cold War background, does this feel familiar?

The Cold War was all about ideology, and therefore a large concept was something that we today call hybrid warfare. In that game the actual technological attacks are equally important as the psychological influencing of the general population with misinformation and misdirection. So this is all very familiar.

Also, something we in the Western world don’t understand is how deeply patriotic Russians are. Individual Russians, and self-organized groups, are willing to go to great lengths on their own, with their own initiative, if they believe that what they do will benefit Mother Russia, and/or in hope and believe that their actions once known will be rewarded. So this kind of self-initiated actions which do resemble organized operations are commonplace. Bearing in mind that the self-organized groups can have members whose day jobs are close to the government the remaining question is, is the government aware of these groups, and if they are, are they encouraging or discouraging? Which is something we cannot know. But the fact of the matter is that Russia is self-organizing and self-providing the capability of plausible deniability which in many case can be actually true that they didn’t know.

Also, it is good to understand how high is the level of science education in Russia and the eastern bloc, when East Germany and West Germany united they had to tone down the science education in East Germany in order to match the West Germans. Science education in East Germany was way higher. The percentage of people in the general population of Russia who possess the relevant skill sets for carrying out this kind of attack is higher than we assume based on western standards. And that’s not just Russia but the whole Eastern Bloc, it was very high and is still.

Given the number of, say, smartphones and laptops used today how hard is it to fend off an attack?

In today’s world where we have “bring you device” models everywhere, we inherently assume every risk the wireless world brings to us. Our laptops and mobile phones are paired to our home networks and other wireless places we visit. It is still not understood how little security WiFi has and how easy it is with an “evil” access point to gain a connection to a target, and once you have a target you can start to work to gain access.

To mitigate this we have two possible paths. One path is to ultra-high security with all the restrictions it comes with. The alternative is to assume a breach is imminent and utilize experts to put in place an active defense mechanism which catches the breach before the attacker can use the breach to gain access to valuable information.

What would an appropriate US response be if the U.S. discovered foreign hackers in its election system?

The first action is obviously to secure your home base. Taking into account the difficulty of identifying the actual attacker, a public retaliation towards an assumed attacker may be part of the attacker’s plan and intensify the attack. Hence, public retaliation is not an effective defense. Public disclosure is important, but after the fact and after the situation has been properly handled.

Finally what is the real risk here? Could Russian hacking throw the Nov. 8 result into doubt? Could Trump supporters, should they lose, blame Russia, for example?

There’s a myriad of risks. Just to start from the simple fact that attacking the voter registration system is a highway to all crimes involving identity theft. Therefore, massive breaches of voter registration databases might lead to discouragement of people to participate in the democratic process and cause them to drop out by ceasing to be registered voters. It also poses a national security level threats, by allowing malicious actors and adversaries to gain valuable intel whether it is personal-level attacks or whether it is for hybrid warfare psyops.

It is also important to understand that data theft takes the public interest. but detect injection or insertion is far more serious. In this attack, the U.S. could be a set up for later attacks and set up false identities to be leveraged for multiple purposes in and out of the election space.

For example, a voter registration database interacts with a lot of government databases, such as criminal records. While common sense might say this kind of interaction should be a one way street, in reality the implementations quite often allow two-way interaction between the data sources. Therefore from one jurisdiction to another it should be carefully analyzed what kind of data propagation inserted voted records could lead to. Remember only US citizens can be voters, so a registered voter is assumed to be a citizen already.